WordPress XSS2Shell Flaw Can Lead to PHP Code Execution
Summary
CERT-AGID reports that CVE-2026-64638, a pre-auth reflected XSS in WordPress login pages, can be chained to PHP execution if an authenticated admin is socially engineered to interact. Patches are available; CERT-AGID knows of no public evidence of exploitation.
Key points
- CVE-2026-64638 is a high-severity reflected XSS flaw in the WordPress authentication page, rated CVSS 8.9; crafted username input can be interpreted as HTML after sanitization.
- The XSS can enable JavaScript execution in the WordPress domain without prior credentials.
- Researchers at pwn[.]ai demonstrated a conditional chain requiring an authenticated administrator to interact with an attacker-prepared page; the chain can abuse the admin session to create an Application Password, upload a plugin, and execute PHP.
- The WordPress advisory says remote code execution depends on conditions not fully controlled by the attacker and requires social engineering and explicit victim interaction.
- Public proof-of-concept code and a GitHub lab based on WordPress 7.0.2 are available.
- Affected versions include WordPress releases before their respective fixes, across branches from 7.0 through 4.7; fixes include 7.0.3, 6.9.6, and backports through 4.7.34.
- CERT-AGID reports no public evidence of real-world exploitation and urges prompt updates, checks for suspicious accounts, Application Passwords, plugins, and files, and investigation of any signs of compromise.
Article Details
- Vulnerability Types
- Reflected cross-site scripting (XSS)
- Remote code execution (RCE) through a conditional attack chain
- Severity
- High (CVSS 8.9)
- Affected Versions
- WordPress 7.0.0–7.0.2
- WordPress 6.9.0–6.9.5
- WordPress 6.8.0–6.8.6
- WordPress 6.7.0–6.7.5
- WordPress 6.6.0–6.6.5
- WordPress 6.5.0–6.5.8
- WordPress 6.4.0–6.4.8
- WordPress earlier branches up to 4.7
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available